vuejs / vue

This is the repo for Vue 2. For Vue 3, go to https://github.com/vuejs/core
http://v2.vuejs.org
MIT License
207.98k stars 33.68k forks source link

inDoc(node, win) causes Uncaught SecurityError #2884

Closed ajorias closed 8 years ago

ajorias commented 8 years ago

Vue.js version

1.0.23

Steps to reproduce

I embed a youtube link via jwplayer. The jwplayer is instantiated via a

<div id="jwplayer></div>

When certain manipluations via vue.js happen I get the error

JS ERROR: Uncaught SecurityError: Blocked a frame with origin "https://...." from accessing a cross-origin frame. .... Error: Blocked a frame with origin "https://...." from accessing a cross-origin frame.

From there on vue.js does not function properly.

What is Expected?

vue.js should not interfere with the iframe that is embedded via jwplayer.

What is actually happening?

The exception seems to happen here:

` /* * Check if a node is in the document. * Note: document.documentElement.contains should work here * but always returns false for comment nodes in phantomjs, * making unit tests difficult. This is fixed by doing the * contains() check on the node's parentNode instead of * the node itself. * @param {Node} node * @return {Boolean} */

function inDoc(node, win) {
    win = win || window;
    var doc = win.document.documentElement;
    var parent = node && node.parentNode;
    var isInDoc = doc === node || doc === parent || !!(parent && parent.nodeType === 1 && doc.contains(parent));
    if (!isInDoc) {
        var frames = win.frames;
        if (frames) {
            for (var i = 0; i < frames.length; i++) {
                if (inDoc(node, frames[i])) {
                    return true;
                }
            }
        }
    }
    return isInDoc;
}`

In the line:

var doc = win.document.documentElement;

yyx990803 commented 8 years ago

This has been fixed in 1.0.24: https://github.com/vuejs/vue/releases/tag/v1.0.24